note 112222 added to function.chr

@gschafer at robandger dot com: Your randPass function is not uniformly distributed, as about every third character is a number (because the probability a numeric character comes up is 33%) - this makes it vulnerable for brute force attacks (if you use all characters from a to z, A to Z and 0 to 9, the probability of a numeric char should be at 10/62 = 16%, so if an attacker would guess a password returned by your function, he would include 17% more numbers). There are totally (10 + 26 + 26) ^ len = e^(ln62 * len) possibilities, where 'len' is the length of the password. But in your function, it is more probable that only about 10^(len'/3) * (26 + 26)^(len'*2/3) = e^((ln10 / 3 + ln52 * 2/3) * len') possibilities are returned. In comparison of len to len', a password returned by your function with 10 characters is actually as safe as an uniformly distributed password with about 8.2 characters. Actually, your function should look like: <?php function randPass($len) { $pw = ''; //intialize to be blank for($i=0;$i<$len;$i++) { $char = rand(0, 61); if ($char < 10) $pw.= chr(48 + $char); //0-9 elseif (($char -= 10) < 26) $pw.=chr(65 + $char); //A-Z elseif (($char -= 26) < 26) $pw.=chr(97 + $char); //a-z } return $pw; } ?> ---- Server IP: 69.147.83.199 Probable Submitter: 79.243.217.245 ---- Manual Page -- http://php.net/manual/en/function.chr.php Edit -- https://master.php.net/note/edit/112222 Del: integrated -- https://master.php.net/note/delete/112222/integrated Del: useless -- https://master.php.net/note/delete/112222/useless Del: bad code -- https://master.php.net/note/delete/112222/bad+code Del: spam -- https://master.php.net/note/delete/112222/spam Del: non-english -- https://master.php.net/note/delete/112222/non-english Del: in docs -- https://master.php.net/note/delete/112222/in+docs Del: other reasons-- https://master.php.net/note/delete/112222 Reject -- https://master.php.net/note/reject/112222 Search -- https://master.php.net/manage/user-notes.php